How to build a cyber capable board

Photo by Benjamin Child on Unsplash

In just a few years, cyber has transformed from the nerd in the corner into the Kim Kardashian of risk. Everyone, it seems, has an opinion on the issue. That’s because it’s serious — businesses can be built on, and destroyed by, cyber risk.

The World Economic Forum’s Global Risks Report has consistently ranked cyber attacks among the top seven risks facing the planet in terms of likelihood and impact, while high-profile CEOs including Warren Buffett of Berkshire Hathaway and Jamie Dimon of JPMorgan Chase see them as the number-one threat to business.

Despite this, a 2019 poll of 1,300 large international organisations by insurance broker wtw found that only 11 per cent of boards have taken direct responsibility for their firms’ cyber security.

Although the private sector’s investment in protective tech and compliance has increased, few business leaders have a clear understanding of cyber risk and confidence that the necessary safeguards are in place at their firms.

These ten practical steps will ensure that your top team is as ready as it can be.

1 Lead from the front

Effective cyber security requires leadership, which should come first from the board and then from the executive responsible for this aspect of the business. This is the other way round in many companies, with boards looking to their security leaders for guidance and objectives. Ask your cyber exec to explain the threats facing the organisation. Then give them clear guidance on how quickly you want these addressed and what level of risk you can live with.

2 Talk to your CISO

Few chief information security officers (CISOs) have a close relationship with the board in their organisations — many do not report to it directly. Meanwhile, the chief information officer, who has a very different mandate, often covers cyber security at the most senior level, yet IT operations and security priorities frequently conflict. Boards can learn a lot from how security and technology leaders work together, but the best way to do this is to consult both of them.

3 Ask all the right questions

To understand your firm’s level of resilience, ask your security leader to tell you: what data systems and assets you have, where they are and which are important (most aren’t); what scenarios are most worrying and how your controls will prevent them; how you will find out — and how quickly — when something goes wrong; and how the organisation will respond if the worst happens, plus its chances of recovery. Use their answers to guide your incident response plan.

4 Demand clarity in reporting

Recent research has found that 96 per cent of board members want to invest more in cyber security. What’s stopping them? Security reporting can often be qualitative (terms such as “high”, “medium” and “low” risk can be interpreted differently) or unrelated to business goals. Insist on risk assessments that quantify the likelihood and impact of a cyber security breach. How does the potential cost of an incident compare with your investment? Make sure you know what the information reported to you really means.

5 Get more from your non-execs

Not every company needs a dedicated “cyber NED”, but it is crucial to have someone on the board who has enough experience and knowledge to ask the right questions of the specialists. That person could have led an executive-level response in the past or observed how other firms’ boards approached a cyber incident. The challenge here is to get the appropriate skills on your board. Don’t assume that your most technically literate board member, such as a former chief information officer, will automatically fulfil this role. Instead, assess the capabilities of the board and form a plan to address any gaps in knowledge.

6 Play your part in simulations

Our research indicates that only 13 per cent of board members feel they have learnt from the security mistakes their firms have made. A key contributor to this is a lack of understanding about how to handle a crisis. All companies should regularly test their readiness. This can be done as a desktop exercise, but it’s better if you make it as real as possible. For instance, the IBM X-Force Command Cyber Tactical Operation Center offers a training platform that can run full-scale simulations of cyber incidents. A board member should get actively involved in such exercises to practise how to respond.

7 Practise dealing with the media

Serious cyber incidents will hit the headlines, so you need to have a media management strategy ready to limit any reputational damage. Baroness Dido Harding, TalkTalk’s CEO in 2010–17, sought to do the right thing by making a prompt public announcement when a cyber attack in 2015 compromised the details of millions of customers, yet she still had to handle intense criticism. Bring in a public relations specialist or crisis management adviser, choose scenarios that most concern you and then stand in front of a camera and, with their help, practise how to handle a grilling from the media.

8 Focus on the human aspects

Cyber risk is seen as an IT issue, but our research shows that 90 per cent of incidents leading to cyber insurance claims resulted from human behaviour. Your HR, IT and security teams should work together on this — discuss how your company’s culture supports cyber security and risk management.

9 Challenge Risk Transfer Strategies

Cyber insurance is not a get our of jail free card, but many simply accept it at face value. Insurance can help reduce the immediate costs when incident occur, but really only smooths these costs out over several years. You need to look at the reasonable worst case scenario rather than the ‘average’ year to make sure you have sufficient cover, and you need to have the right controls or insurers may not pay out. With more cyber incidents relating to geopolitical conflict, war exclusions are a growing issue. And your insurer may have different ideas to you on how to respond or which support providers to use. Finally, if you do take out insurance and criminals find out, that can make you a more attractive target — so the best cyber policy is a carefully designed and confidential one.

10 Plan for ransomware

Ransomware is a particular evil because it renders data unavailable or harms it’s integrity. This can be much more operationally disruptive than data loss. Unfortunately, every time a ransom is paid we encourage the criminals to come back for more. Yet when an incidents happens we can feel under pressure from shareholders or insurers to pay. Instead, define and communicate to stakeholders in advance what you would do. Explain why you would not pay, and be clear that you understand the implications either way. With advance stakeholder support, you can make strong and rapid decisions that customers and shareholders will respect and understand as in the best long term interest of the company. At the same time, reduce the operational risk by making sure you have segregated backups that can be quickly restored. Ask your CIO and CISO for a plan for ‘recovery from zero’ — no data, no equipment — and make sure the company would survive it.

As a NED myself, I understand this challenge. The above steps can all be implemented within six months and will put your board in a strong position to lead on cybersecurity, as well as providing confidence to board members and stakeholders.

This article is an updated version of an article that first appeared in the UK Institute of Directors’ Director Magazine, and includes two further recommendations led by reader feedback that were not included in the original article.

*** This is a Security Bloggers Network syndicated blog from Stories by Matt Palmer on Medium authored by Matt Palmer. Read the original post at: